index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("85.14.253.178")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("85.14.253.178")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("85.14.253.178")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("85.14.253.178")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("85.14.253.178")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("85.14.253.178")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("85.14.253.178")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("85.14.253.178")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("85.14.253.178")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("85.14.253.178")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("85.14.253.178")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("85.14.253.178")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("dc7c07bac0ce9d431f51e2620da93398","d17f58c6c9771e03342cdd33eb32e084","ad4a6a0ddeacdf0fc74c3b45b57a1316","de14cf1e58d288187680f5938e2250df","d60b6a8310373c9b84e6760c24185535","72149bbd364326618df00dc6b0e0b4c4","0d12e8754adacc645a981426e69b91ec","8f5302dafa90958117cbee992a0e09a9","f4c77f40e325a420be4660370a97158c","ce80bf89bbc800547039844d400ab27c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("dc7c07bac0ce9d431f51e2620da93398","d17f58c6c9771e03342cdd33eb32e084","ad4a6a0ddeacdf0fc74c3b45b57a1316","de14cf1e58d288187680f5938e2250df","d60b6a8310373c9b84e6760c24185535","72149bbd364326618df00dc6b0e0b4c4","0d12e8754adacc645a981426e69b91ec","8f5302dafa90958117cbee992a0e09a9","f4c77f40e325a420be4660370a97158c","ce80bf89bbc800547039844d400ab27c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("dc7c07bac0ce9d431f51e2620da93398","d17f58c6c9771e03342cdd33eb32e084","ad4a6a0ddeacdf0fc74c3b45b57a1316","de14cf1e58d288187680f5938e2250df","d60b6a8310373c9b84e6760c24185535","72149bbd364326618df00dc6b0e0b4c4","0d12e8754adacc645a981426e69b91ec","8f5302dafa90958117cbee992a0e09a9","f4c77f40e325a420be4660370a97158c","ce80bf89bbc800547039844d400ab27c")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("dc7c07bac0ce9d431f51e2620da93398","d17f58c6c9771e03342cdd33eb32e084","ad4a6a0ddeacdf0fc74c3b45b57a1316","de14cf1e58d288187680f5938e2250df","d60b6a8310373c9b84e6760c24185535","72149bbd364326618df00dc6b0e0b4c4","0d12e8754adacc645a981426e69b91ec","8f5302dafa90958117cbee992a0e09a9","f4c77f40e325a420be4660370a97158c","ce80bf89bbc800547039844d400ab27c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("dc7c07bac0ce9d431f51e2620da93398","d17f58c6c9771e03342cdd33eb32e084","ad4a6a0ddeacdf0fc74c3b45b57a1316","de14cf1e58d288187680f5938e2250df","d60b6a8310373c9b84e6760c24185535","72149bbd364326618df00dc6b0e0b4c4","0d12e8754adacc645a981426e69b91ec","8f5302dafa90958117cbee992a0e09a9","f4c77f40e325a420be4660370a97158c","ce80bf89bbc800547039844d400ab27c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("dc7c07bac0ce9d431f51e2620da93398","d17f58c6c9771e03342cdd33eb32e084","ad4a6a0ddeacdf0fc74c3b45b57a1316","de14cf1e58d288187680f5938e2250df","d60b6a8310373c9b84e6760c24185535","72149bbd364326618df00dc6b0e0b4c4","0d12e8754adacc645a981426e69b91ec","8f5302dafa90958117cbee992a0e09a9","f4c77f40e325a420be4660370a97158c","ce80bf89bbc800547039844d400ab27c")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tnskvggujjqfcskwk.com" OR destinationhostname CONTAINS "bypassociation.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tnskvggujjqfcskwk.com" OR destinationhostname CONTAINS "bypassociation.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tnskvggujjqfcskwk.com" OR destinationhostname CONTAINS "bypassociation.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://bypassociation.com","https://bypassociation.com/images/sync?type=name","https://bypassociation.com/new?type=name","https://bypassociation.com/pictures/hide?type=name","https://bypassociation.com/pictures/show?type=name","https://bypassociation.com/images/hide?type=name","https://bypassociation.com/img/hide?type=name","https://bypassociation.com/img/add?type=name","https://bypassociation.com/images/add?type=name","https://bypassociation.com/info/hide?type=name")
